From 4ae5a51b765786346dc13efc260d7142e8bcb530 Mon Sep 17 00:00:00 2001 From: Branden Archer Date: Sun, 25 Oct 2020 23:13:46 -0700 Subject: Add fuzz tests for deserialzing fuzzed data The existing tests in this fuzzer take fuzzed data, serialize it into something, then deserialize the result. These new tests take the fuzzed data and pass it directly to the deserializing code. Bug: 170243740 Test: Builds and runs Change-Id: I0a7a3a8230b545feaef46628b8a1883b8e32f27a --- libs/vr/libpdx/fuzz/serialization_fuzzer.cpp | 173 +++++++++++++++++++++++++++ 1 file changed, 173 insertions(+) (limited to 'libs') diff --git a/libs/vr/libpdx/fuzz/serialization_fuzzer.cpp b/libs/vr/libpdx/fuzz/serialization_fuzzer.cpp index 1703f48f0e..f5c5a5a4c4 100644 --- a/libs/vr/libpdx/fuzz/serialization_fuzzer.cpp +++ b/libs/vr/libpdx/fuzz/serialization_fuzzer.cpp @@ -108,8 +108,181 @@ void FuzzSerializeDeserialize(const uint8_t* data, size_t size) { Deserialize(&t1_val, &result); } +void FuzzDeserializeUint8(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = {ENCODING_TYPE_UINT8, fdp.ConsumeIntegral()}; + std::uint8_t result; + Deserialize(&result, &buffer); +} + +void FuzzDeserializeUint16(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = {ENCODING_TYPE_UINT16, fdp.ConsumeIntegral(), + fdp.ConsumeIntegral()}; + std::uint16_t result; + Deserialize(&result, &buffer); +} + +void FuzzDeserializeUint32(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = {ENCODING_TYPE_UINT32, fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral()}; + std::uint32_t result; + Deserialize(&result, &buffer); +} + +void FuzzDeserializeUint64(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = { + ENCODING_TYPE_UINT64, fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), fdp.ConsumeIntegral(), + fdp.ConsumeIntegral()}; + std::uint64_t result; + Deserialize(&result, &buffer); +} + +void FuzzDeserializeInt8(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = {ENCODING_TYPE_INT8, fdp.ConsumeIntegral()}; + std::int8_t result; + Deserialize(&result, &buffer); +} + +void FuzzDeserializeInt16(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = {ENCODING_TYPE_INT16, fdp.ConsumeIntegral(), + fdp.ConsumeIntegral()}; + std::int16_t result; + Deserialize(&result, &buffer); +} + +void FuzzDeserializeInt32(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = {ENCODING_TYPE_INT32, fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral()}; + std::int32_t result; + Deserialize(&result, &buffer); +} + +void FuzzDeserializeInt64(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = {ENCODING_TYPE_INT64, + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral()}; + std::int64_t result; + Deserialize(&result, &buffer); +} + +void FuzzDeserializeFloat32(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = {ENCODING_TYPE_FLOAT32, fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral()}; + float floatResult; + Deserialize(&floatResult, &buffer); + + buffer.Rewind(); + double doubleResult; + Deserialize(&doubleResult, &buffer); +} + +void FuzzDeserializeFloat64(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = { + ENCODING_TYPE_FLOAT64, fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), fdp.ConsumeIntegral(), + fdp.ConsumeIntegral()}; + double result; + Deserialize(&result, &buffer); +} + +void FuzzDeserializeFixstr(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + std::string s_val = fdp.ConsumeRemainingBytesAsString(); + Payload buffer = {ENCODING_TYPE_FIXSTR_MAX}; + for (std::string::iterator iter = s_val.begin(); iter != s_val.end(); + iter++) { + buffer.Append(1, *iter); + } + std::string result; + Deserialize(&result, &buffer); +} + +void FuzzDeserializeFixmap(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = {ENCODING_TYPE_FIXMAP_MAX}; + // Fill the map with the fuzzed data, not attempting to + // make a valid map + while (fdp.remaining_bytes() > 0) { + buffer.Append(1, fdp.ConsumeIntegral()); + } + + std::map result; + Deserialize(&result, &buffer); + + buffer.Rewind(); + std::unordered_map unorderedResult; + Deserialize(&unorderedResult, &buffer); +} + +void FuzzDeserializeVariant(const uint8_t* data, size_t size) { + FuzzedDataProvider fdp = FuzzedDataProvider(data, size); + Payload buffer = {ENCODING_TYPE_INT16, + ENCODING_TYPE_FLOAT32, + ENCODING_TYPE_FIXSTR_MAX, + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral(), + fdp.ConsumeIntegral()}; + // Add the rest of the data as a string + std::string s_val = fdp.ConsumeRemainingBytesAsString(); + for (std::string::iterator iter = s_val.begin(); iter != s_val.end(); + iter++) { + buffer.Append(1, *iter); + } + Variant result; + Deserialize(&result, &buffer); +} + +// Attempts to deserialize fuzzed data as various types +void FuzzDeserialize(const uint8_t* data, size_t size) { + FuzzDeserializeUint8(data, size); + FuzzDeserializeUint16(data, size); + FuzzDeserializeUint32(data, size); + FuzzDeserializeUint64(data, size); + FuzzDeserializeInt8(data, size); + FuzzDeserializeInt16(data, size); + FuzzDeserializeInt32(data, size); + FuzzDeserializeInt64(data, size); + FuzzDeserializeFloat32(data, size); + FuzzDeserializeFloat64(data, size); + FuzzDeserializeFixstr(data, size); + FuzzDeserializeFixmap(data, size); + FuzzDeserializeVariant(data, size); +} + extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { FuzzSerializeDeserialize(data, size); + FuzzDeserialize(data, size); return 0; } -- cgit v1.2.3-59-g8ed1b